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A fast, secure and easy to use Forensic System for Mobile Phone Examination 

With the SIM investigator system you can download data from the SIM and the hand- 
set in a mobile phone quickly and securely. A copy of all data is downloaded in only a 
few minutes and then the data can be analyzed or used as evidence. The SIM investi- 
gator software guarantees that the data in the mobile phone cannot be changed or de- 
leted. 

Examples of data that SIM investigator can download: 

- Phone books - names, numbers, E-mail etc. 

- Text messages - sent, received, unsent and archived 

- Calls - dialed, missed and received calls 

- Pictures - stored pictures and pictures taken 

- Calendar information 

- Tasks 

- Audio files 

- I M El, IMSI 



The software automatically recogniz- 
es what mobile phone is connected 
to the communication unit. No special 
setup is required to start reading the 
mobile phone. SIM investigator has 
been developed in consultation with 
Swedish Customs, the Swedish Po- 
lice and the Swedish National Labora- 
tory of Forensic Science, and with 
feedback from the UK Police. 



Communication Unit 




The SIM investigator communication unit can communicate with the mobile phone via 
IR, Bluetooth or cable. The unit connects to a PC via USB. The communication unit is 
built to be flexible, robust and portable, to suit both fieldwork and office work. 



USB 

Connection to a USB cable makes it easy to connect all kinds of mobile phones. SIM 
investigator is delivered with an USB interface. You can use either the mobile phone 
manufacturer's cables or Gamma's cables. 



Bluetooth 

Bluetooth is a standard that is a feature of many newer phone models. SIM investigator 
is delivered with Bluetooth interface. 



IR 

Infrared is still very common as a feature in mobile phones. SIM investigator is deli- 
vered with IR interface. 
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Hardware Key 

The SIM investigator software can be installed in an optional number of computers. To 
carry out an examination of a mobile phone, just connect the communication unit using 
the USB key that comes with the system. The key also counts the examinations. 



Charging 

A smart universal charger is included in the SIM investigator system. You can easily 
charge the mobile phone before doing an examination. 



Complete Report 

SIM investigator creates a report of all downloaded data. The report is also ready for 
administrative data as case reference, operator, exhibit id and other information useful 
to the investigation. Your own logotype, address and other contact details can easily be 
entered into the report. The time and date of the examination are generated automati- 
cally. 



Calls and Text Messages 

A clear presentation of all incoming, outgoing and missed calls that the phone has the 
capacity to store is listed. Any name stored with a telephone number is also included. 
Text messages read, sent, unsent and archived are also listed. All the data is specified 
with its storage location in the phone - the SIM or in the Device. 



Contact Data 

All data about the contacts in the phone are listed as name, phone number, and mobile 
number, E-mail etc. All the data is specified with its storage location in the phone - the 
SIM or in the Device. 



Pictures 

All the pictures that are stored in the phone are listed in the report. The built-in preview 
function enlarges the picture for a first look. 



Audio 

All audio files that are stored in the phone are listed in the report. The audio files can be 
played directly from SIM investigator. 



Continuously Developing 

SIM investigator is continually being developed apace with new features in phones and 
new phone models on the market. 
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Additional Features 

Export: export of all data or selected data. 

Print: printed report of all data or selected data. 

Search: search for a name, number, text or other data directly in the software. 

Collected data: The system creates a file that includes all the down- 
loaded data from the phone. The extension of the file is SIM investigator 
and no separate files for pictures and audio files are necessary. 



SIM Reader: with the SIM Reader you can send a SIM investigator file to someone 
who does not have the SIM investigator system. SIM Reader is a free 
download and together with an SIM investigator file all downloaded data 
can be read. The SIM Reader is ready to run and does not require instal- 
lation. 



Encryption: the SIM investigator file is encrypted to secure the file from unauthorized 

access. 
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The whole XRY System 
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1 . Mobile phones & mobile communication forensics: 
traditional method (without XRY) 



Manual work 

Extraction of evidence from mobile phones involves very often a lot of manual work 
with risks for various errors. Usual phones often require several hours of work. Modern 
phones contain more and more data and the extraction requires more and 
more time. 



Lacks of speed & effectivity 

Speed is often critical in most investigations. A simple SMS, call list or entries of the 
telephone book can reveal important connections between suspects. Waiting hours for 
data from a telephone is frustrating for the investigators who put pressure on the fo- 
rensic technicians. 



Hazardous reliability & security 

Manual creates unnecessary risks for errors. The lack of documentation makes it im- 
possible to know exactly what data to expect to retrieve from a phone so you can miss 
important details. Nothing guarantees the integrity of the information you have ob- 
tained. 



Significative costs 

Because of the critical importance of the information you can obtain and the technical 
evolution of mobile phones, you will have to spend some more and more time to ex- 
amine them. Spending time on telephones supposes spending resources. 



2. The SIM investigator System 

Automatic extraction 

SIM Investigator System automatically recognizes the connected phones; the extraction 
is then launched and completed automatically as well. A ready-to-use report is generat- 
ed. It can be diffused or screened directly in SIM investigator or exported to any appli- 
cation. 



Speed & effectivity 

As the ready-to-use report has been automatically generated after about 20 minutes, 
you saved a lot of time doing something else during the extraction. 



Optimal reliability & security 

No manual work is needed: risks for errors are eliminated. The data goes only from the 
phone to the SIM investigator software. No modification of the phone nor its content is 
possible. The phone is safe under and after the extraction. The information is secured in 
the SIM investigator report both using SIM investigator or SIM investigator reader. 
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The report is protected by encryption and a harsh-key. The report can be protected by a 
password. The performance of SIM investigator is fully documented on each supported 
phone in the XRY phone manual so you know exactly what data you will retrieve before 
proceeding to the extraction. 



Flexibility 

The information can be screened and diffused directly into the SIM investigator soft- 
ware or the SIM investigator Reader. SIM investigator Reader is the free version of SIM 
investigator software. 

Reports can be sent on a CD either SIM investigator Reader: they can be screened on 
any PC then without any installation. 

All information can also be exported to any other application by a single click. 



Signifivative savings 

Saving much time on mobile phones examination will save you a lot of resources. You 
will be able to treat many more mobiles more effectively, leading to new savings on the 
investigations. 



Composition of the SIM investigator system : 

• Software on CD 

• A communication unit equipped with a Bluetooth port, an infrared port and a USB 
port 

• USB telephone cables, telephone-specific, 22 pieces 

• A USB key that also functions as a counter 

• A USB cable for connecting between computer and communication unit 

• A SIM/USIM-Card reader which is tested with SIM investigator 2.x system 

• Manuals in PDF format 



Customer Benefits 

Reads the logical phone memory based on using an "Examination SIM-card", which un- 
locks access to logical memory, for example, call list, etc. valuable information. 

Scenario 1: 

There is a SIM-card in the phone, which is locked, and it is difficult to get information at 
short notice from the mobile network provider, for example, PIN/PUK code. With the 
"TSE 4018 Examination SIM card" product the examiner can create a "SIM-card 
copy/clone" which gives access to the logical phone memory. 

(NOTE: This is valid for phones where only ICCID is needed). 

Scenario 2: 

There is no SIM-card since it has been lost or damaged. With the "TSE 4018 Examina- 
tion SIM card" product the examiner can create a "SIM-card copy/clone" which gives 
access to the logical phone memory. 

(NOTE: The examined needs either ICCID or I MSI, which requires a contact with the 
mobile network operator, i.e. it is probably easier if the operator is a local one or infor- 
mation exchange with police is well established). 

Scenario 3: 

The SIM-card is available and open to read, but the examiner prefers to have the mobile 
phone out of the mobile operator network ("radio signal silence"), for example, to avoid 
having the memory changed by incoming calls, SMS etc. With the TSE 4018 the ex- 
aminer can create a partial copy of the SIM-card, which is "radio signal silent". 
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Provided by G2 SYSTEMS to use the product: 

1 ) The TSE 4018 Software product (will be integrated with the TSE 401 8) 

2) SIM-card reader (which is the same as used with the TSE 4018) 

3) Prepared and tested SIM examination cards 

4) Information in a manual for each phone model on how to use this product 

5) Support 



Informations obtained by the SIM investigator (not a comprehensive list) 

• Received SMS messages saved on SIM cards 

• Received SMS messages saved on the mobile phone's internal memory 

• Times, dates & numbers from which SMS messages have been sent 

• Contacts on SIM cards, mobile phone numbers 

• Erased SMS messages (With the XRY integrated SIM card reader) 

• Contacts on the mobile phone's internal memory incl. subsidiary information such 
as e-mail, addresses, fax numbers, etc. 

• Calendar information 

• "To do" information 

• Missed calls 

• Received calls 

• Dialed numbers 

• Pictures 

• Sound files 

• IMEI 

• IMSI 

• Time and date on the mobile phone, and matching these to the same on a comput- 
er 

• The Unicode function allows reading and extracting information in any language in- 
cluding Hebrew, Russian, Arab, Chinese etc. 

• & more to come with frequent free upgrades 



General functionalities 

• Automatic recognition of connected supported phones 

• Automatic creation of a ready-to-use report • Export of the information in any other 
application by a single click 

• Export directly to MS Excel by a single click 

• Complete print function 

• Search engine to search specific information in the report 

• Encryption • Flexible design of the report 

• Diffusion of information with the SIM investigator reader 

• Extraction from non-supported phones enabled • Saves a complete log-file in txt 
from each extraction process 

• Abortion and saving of pending extraction enabled 

• Unicode for extractions in any language including russian, arab, chines, hebrew etc. 

• & more to come with frequent free upgrades 



SIM investigator supported phones 

SIM investigator 2.4 supports more than 170 different models of mobile phones from 
brands like Ericsson, Sony Ericsson, Nokia, Samsung, Siemens, Motorola, LG, Sagem, 
Sharp and Panasonic. 

All supported phones are recognized automatically by the SIM investigator and fully do- 
cumented in the SIM investigator phone manual. Non-supported but similar phones can 
also be identified manually, to be examined with SIM investigator. 

More models and brands are constantly added with every new release. New releases 
are shipped to G2 systems Ltd's customers every two month with new functionalities 
numbers of new supported phones each time. 
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If you would like further Information about ELAMAN, 
or would like to discuss a specific requirement or project, please contact us at: 

Elaman GmbH 
German Security Solutions 
Seitzstr. 23 
80538 Munich 
Germany 

Tel: +49-89-24 20 91 80 
Fax: +49-89-24 20 91 81 
info@elaman.de 
www.elaman.de 









